There has been quite some moons that passed by before we came to the new release of RO Single Sign On 2.3.0. This release is all worth it. We have added numerous features that add setting up and maintaining Single Sign On a breeze.
SimpleSAMLphp
The SimpleSAMLphp library has been updated from version 2.4.4 to version 2.5.3 which is the current release of SimpleSAMLphp.
Refresh metadata
To make sure that an SSO (Single Sign On) setup keeps working, it is important to regularly update the metadata. This is done by setting up a cronjob that calls the metarefresh module. In the past you have to build all the necessary files for this to work manually, now RO Single Sign On does this automatically. All you need to do is setup the cronjob and you are ready to go.
Joomla Update
When performing a Joomla update it is possible that you get a login screen before the actual update starts. This page now also features the SSO button so you can continue with your active SSO session.
Multi-factor authentication
RO Single Sign On now also handles login using multi-factor authentication when it serves as an Identity Provider. We have added support for TOTP and Passkeys. In a setup where your site is a Service Provider there should be no use for multi-factor authentication. However, if you do plan on using multi-factor authentication you can bypass it for SSO logins.
How to configure the bypass is explained in the document Bypass Multi-factor Authentication on Single Sign On Login.
Content-Security-Policy headers
The default installation comes with a theme that allows users to login when your setup runs as an Identity Portal. However if you want to use your custom theme so it matches the rest of your site is usually desired. When rendering a page you want to be able to control the Content-Security-Policy (CSP) so you can control what can be loaded on your site. CSP headers are now integrated in the configuration screen so you can easily manage them.
Other changes
The full list of changes in this release:
- Fixed escape word not always checked on login
- Fixed saving IDP profile failed due to missing ordering having no default
- Fixed symlink to be relative and not absolute on installation
- Fixed to not create a user session if the username or password is wrong
- Added CSP configuration for the SimpleSAMLphp login page
- Added automatic generation of module_cron and module_metarefresh to allow for automatic updates of metadata for both IDP and SP using cron
- Added check for old style NameIDPolicy and fix it automatically
- Added configuration option for managing available languages in SimpleSAMLphp
- Added database check on installation
- Added default modules on a clean installation
- Added support for Single Sign On on the Joomla Update page
- Added support for handling TOTP
- Added support for installations in subfolders
- Removed usage of CMSObject
- Changed improve setting up a site as both an IDP and SP
- Changed processing users who have logged-in using SAML but are not allowed on the site because they have no account
- Changed the design of the dashboard
- Changed to check if the database port is part of the hostname
- Changed to update authsources.php when an IDP URL changes
- Changed to use our own database verification tool
- Updated to SimpleSAMLphp 2.5.2
This release is available for free to everyone with an active subscription from the Download section. If you do not have a subscription yet, you can subscribe here.